netdev - RE: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leak and use-after-free in ixgbe_recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <IA3PR11MB8986BB7E1C9B70B43014F1BDE507A@IA3PR11MB8986.namprd11.prod.outlook.com>
Date: Mon, 1 Sep 2025 07:11:26 +0000
From: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
To: Kohei Enju <enjuk@...zon.com>, "intel-wired-lan@...ts.osuosl.org"
	<intel-wired-lan@...ts.osuosl.org>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
CC: "Nguyen, Anthony L" <anthony.l.nguyen@...el.com>, "Kitszel, Przemyslaw"
	<przemyslaw.kitszel@...el.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Jakub
 Kicinski" <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Wegrzyn,
 Stefan" <stefan.wegrzyn@...el.com>, Mateusz Polchlopek
	<mateusz.polchlopek@...el.com>, "Jagielski, Jedrzej"
	<jedrzej.jagielski@...el.com>, "kohei.enju@...il.com" <kohei.enju@...il.com>,
	Koichiro Den <den@...inux.co.jp>
Subject: RE: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leak and
 use-after-free in ixgbe_recovery_probe()



> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
> Of Kohei Enju
> Sent: Sunday, August 31, 2025 10:33 PM
> To: intel-wired-lan@...ts.osuosl.org; netdev@...r.kernel.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@...el.com>; Andrew Lunn
> <andrew+netdev@...n.ch>; David S. Miller <davem@...emloft.net>; Eric
> Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> Abeni <pabeni@...hat.com>; Wegrzyn, Stefan <stefan.wegrzyn@...el.com>;
> Mateusz Polchlopek <mateusz.polchlopek@...el.com>; Jagielski, Jedrzej
> <jedrzej.jagielski@...el.com>; kohei.enju@...il.com; Kohei Enju
> <enjuk@...zon.com>; Koichiro Den <den@...inux.co.jp>
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leak
> and use-after-free in ixgbe_recovery_probe()
> 
> The error path of ixgbe_recovery_probe() has two memory bugs.
> 
> For non-E610 adapters, the function jumps to clean_up_probe without
> calling devlink_free(), leaking the devlink instance and its embedded
> adapter structure.
> 
> For E610 adapters, devlink_free() is called at shutdown_aci, but
> clean_up_probe then accesses adapter->state, sometimes triggering
> use-after-free because adapter is embedded in devlink. This UAF is
> similar to the one recently reported in ixgbe_remove(). (Link)
> 
> Fix both issues by moving devlink_free() after adapter->state access,
> aligning with the cleanup order in ixgbe_probe().
> 
> Link: https://lore.kernel.org/intel-wired-lan/20250828020558.1450422-
> 1-den@...inux.co.jp/
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery
> mode")
> Signed-off-by: Kohei Enju <enjuk@...zon.com>
> ---
> Cc: Koichiro Den <den@...inux.co.jp>
> ---
>  drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index ff6e8ebda5ba..08368e2717c2 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -11510,10 +11510,10 @@ static int ixgbe_recovery_probe(struct
> ixgbe_adapter *adapter)
>  shutdown_aci:
>  	mutex_destroy(&adapter->hw.aci.lock);
>  	ixgbe_release_hw_control(adapter);
> -	devlink_free(adapter->devlink);
>  clean_up_probe:
>  	disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter-
> >state);
>  	free_netdev(netdev);
I'd add a guard here: if (adapter->devlink)
What do you think?
> +	devlink_free(adapter->devlink);
>  	pci_release_mem_regions(pdev);
>  	if (disable_dev)
>  		pci_disable_device(pdev);
> --
> 2.51.0